CVE-2021-43003
📋 TL;DR
This vulnerability in Amzetta zPortal Windows zClient allows local attackers to execute arbitrary code with kernel privileges or cause denial of service via memory corruption. It affects users of zPortal Windows zClient version 3.2.8180.148 and earlier who have local access to the system.
💻 Affected Systems
- Amzetta zPortal Windows zClient
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via kernel-level arbitrary code execution leading to full administrative control, data theft, and persistent backdoor installation.
Likely Case
Local privilege escalation from standard user to SYSTEM/administrator privileges, enabling attackers to bypass security controls and install malware.
If Mitigated
Limited impact if proper access controls prevent local user execution or if vulnerable component is isolated.
🎯 Exploit Status
Exploitation requires local access but the vulnerability is in a kernel driver, making reliable exploitation straightforward for attackers with basic reverse engineering skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version > 3.2.8180.148
Vendor Advisory: https://www.amzetta.com/security-advisory
Restart Required: Yes
Instructions:
1. Download latest zClient version from Amzetta portal. 2. Uninstall current zClient. 3. Install updated version. 4. Reboot system.
🔧 Temporary Workarounds
Disable zClient service
windowsStop and disable the zClient service if USB over Ethernet functionality is not required
sc stop zClientService
sc config zClientService start= disabled
Remove vulnerable driver
windowsUninstall the vulnerable zClient software completely
Control Panel > Programs > Uninstall zPortal Windows zClient
🧯 If You Can't Patch
- Implement strict local access controls and limit user privileges
- Monitor for unusual process creation from zClient or related services
🔍 How to Verify
Check if Vulnerable:
Check zClient version in Control Panel > Programs or run 'wmic product get name,version' and look for zPortal Windows zClient <= 3.2.8180.148Check Version:
wmic product where "name like '%zPortal%'" get name,versionVerify Fix Applied:
Verify installed version is > 3.2.8180.148 and check that zClient service is running updated binaries📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from zClient.exe
- Kernel driver loading events
- System crashes with zClient driver references
Network Indicators:
- Unusual local process communication patterns
SIEM Query:
Process Creation where Image contains 'zClient' AND ParentImage != expected_parent_process